{"adoption": {"forks": 936, "observed_at": "2026-08-28T04:10:31.230842+00:00", "stars": 9462}, "canonical_url": "https://ross.abutalabs.com/products/syft", "card": {"archived": false, "artifact_type": "cli-tool", "description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems", "domain": ["security", "developer-tools"], "enriched": true, "function": ["developer-tools", "security", "cli", "static-site-generator"], "health_score": 99, "homepage": null, "language": "Go", "license": "Apache-2.0", "license_family": "permissive", "maturity": "active", "member_repos": ["anchore/syft"], "name": "anchore/syft", "platform": ["windows", "go", "cli"], "pushed_at": "2026-08-21T21:36:48+00:00", "repo": "anchore/syft", "stars": 9462, "tags": ["sbom", "spdx", "cyclonedx", "container-images", "supply-chain-security", "vulnerability-scanning", "oci", "containers", "devops", "linux", "macos", "docker"], "topics": ["containers", "docker", "go", "golang", "static-analysis", "tool", "oci", "sbom", "spdx", "cyclonedx", "hacktoberfest"], "urls": [], "use_cases": ["generate an SBOM for a docker image", "inventory packages in a container image", "create SPDX or CycloneDX SBOMs for compliance", "scan a filesystem directory for installed packages", "convert an SBOM between formats", "prepare SBOMs for vulnerability scanning with Grype", "audit software dependencies in OCI images"], "what_it_is": "Syft is a CLI tool and Go library that generates Software Bill of Materials (SBOM) documents from container images, filesystems, and archives. It supports dozens of package ecosystems and outputs standards like SPDX and CycloneDX, pairing with Grype for vulnerability scanning.", "when_to_avoid": ["you need runtime vulnerability scanning alone without SBOM generation (use Grype directly)", "you need dynamic analysis of running processes rather than static package inventory", "you need SBOMs for non-container, non-filesystem sources like source repos only"], "when_to_choose": ["you need standards-compliant SBOMs (SPDX, CycloneDX) from images or filesystems", "you want broad package-ecosystem coverage in one tool", "you plan to feed results into a vulnerability scanner like Grype", "you need a Go library for SBOM generation embedded in your own tooling"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/syft", "repo": "anchore/syft", "role": "main", "score": 98}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:10:31.230842+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-29T17:22:05.969521+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "66f9719b8791d94fa87d22ae3aa9cf5dcea877b6f7e3753d54ffde2b604b40d4", "fetched_at": "2026-08-28T04:10:31.230842+00:00", "kind": "readme", "missing": false, "url": "https://github.com/anchore/syft"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 98, "longevity": 100, "rhythm": 97}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 2309, "days_push": 12, "days_rel": 23, "gap_med": 11, "n_releases_24m": 56}, "score": 98, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}